CVE-2024-10975

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
HashiCorp	Nomad	>= 1.3.0, < 1.9.2
HashiCorp	Nomad Enterprise	>= 1.3.0, < 1.9.2

References

https://discuss.hashicorp.com/t/hcsec-2024-27-nomad-vulnerable-to-cross-namespace-volume-creation-abusing-csi-write-permissionVendor Advisory

Timeline

Published: Nov 7, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-109765.4Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. C CVE-2024-109773.7Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL CVE-2024-109784.2Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended.CVE-2024-109798.8Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environmen CVE-2024-10987.5A vulnerability was found in Rebuild up to 3.5.5 and classified as problematic. This issue affects the function QiniuCloud.getStorageFile of CVE-2024-109805.4The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) WordPress plugin before 5.10.3 CVE-2024-109868.8GPT Academic version 3.83 is vulnerable to a Local File Read (LFI) vulnerability through its HotReload function. This function can download CVE-2024-109876.5A vulnerability was found in code-projects E-Health Care System 1.0. It has been declared as critical. Affected by this vulnerability is an CVE-2024-109889.1A vulnerability was found in code-projects E-Health Care System 1.0. It has been rated as critical. Affected by this issue is some unknown f CVE-2024-109896.5A vulnerability classified as critical has been found in code-projects E-Health Care System 1.0. This affects an unknown part of the file /A CVE-2024-10995.4A vulnerability was found in Rebuild up to 3.5.5. It has been classified as problematic. Affected is the function getFileOfData of the file CVE-2024-109908.8A vulnerability classified as critical was found in SourceCodester Online Veterinary Appointment System 1.0. This vulnerability affects unkn